CVE-2026-55874 SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
An authenticated user can read objects from other buckets via path traversal in the S3 gateway copy header.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55874?
CVE-2026-55874 is a high-severity path traversal vulnerability in seaweedfs, published on 8 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34.
Weakness: CWE-22
Which versions are affected by CVE-2026-55874?
4 open source packages ship an affected version, including github.com/seaweedfs/seaweedfs and seaweedfs.
| Package | Affected | Fixed in |
|---|---|---|
github.com/seaweedfs/seaweedfs Go | All versions | 0.0.0-20260612000715-b44cf51fe931 |
github.com/seaweedfs/seaweedfs Go | All versions | 0.0.0-20260612000715-b44cf51fe931 |
github.com/seaweedfs/seaweedfs Go | All versions | 0.0.0-20260612000715-b44cf51fe931 |
seaweedfs Bitnami | All versions | 4.34.0 |
How do I fix CVE-2026-55874?
Upgrade github.com/seaweedfs/seaweedfs to 0.0.0-20260612000715-b44cf51fe931 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-55874 being exploited?
There is no known exploitation of CVE-2026-55874 in the wild and no public exploit code.
Sources
Also known as BIT-seaweedfs-2026-55874, GHSA-56wq-x3wv-3ff4, GO-2026-6327, MINI-c2vg-2542-rmw4, MINI-fmmc-x39j-p2cq.